CVE-2004-2466
Easy Chat Server 1.2 and 2.2 - Denial of Service via Long Username Parameter
Title source: llmExploitation Summary
EIP tracks 5 public exploits for CVE-2004-2466.
PoCs published by superkojiman, Metasploit, NetJackal, including Metasploit module exploits/windows/http/efs_easychatserver_username.
AI-analyzed exploit summary This exploit targets a stack buffer overflow in Easy Chat Server 3.1 by sending a maliciously crafted HTTP GET request with an overly long username parameter. It leverages SEH overwriting and shellcode execution to spawn calc.exe as a proof of concept.
Description
chat.ghp in Easy Chat Server 1.2 allows remote attackers to cause a denial of service (server crash) via a long username parameter, possibly due to a buffer overflow. NOTE: it was later reported that 2.2 is also affected.
Exploits (5)
This exploit targets a stack buffer overflow in Easy Chat Server 3.1 by sending a maliciously crafted HTTP GET request with an overly long username parameter. It leverages SEH overwriting and shellcode execution to spawn calc.exe as a proof of concept.
This is a Metasploit module exploiting a stack buffer overflow in EFS Easy Chat Server via an overly long username parameter in an authentication request. It leverages SEH overwrite to achieve remote code execution.
This exploit targets a denial-of-service (DoS) vulnerability in Easy Chat Server 2.2 by sending an HTTP GET request with overly long 'username' and 'password' parameters, causing the server to crash. The exploit leverages a buffer overflow in the login page input validation.
This exploit targets a stack-based buffer overflow in Easy Chat Server 3.1 via a crafted HTTP GET request, leveraging SEH overwrite to execute reverse meterpreter shellcode. The payload is generated using msfvenom and bypasses bad characters.
This Metasploit module exploits a stack buffer overflow in EFS Easy Chat Server by sending an overly long authentication request, allowing arbitrary code execution. It uses SEH overwrites and targets specific versions (2.0 to 3.1) with known return addresses in SSLEAY32.dll.